Skip to content

suppressing by id #47

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
marwin1991 merged 3 commits into from
Nov 21, 2024
Merged

suppressing by id #47

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
62f3f53
suppressing by id
Nov 17, 2024
34c6190
Merge branch 'refs/heads/main' into suppresions-by-id
Nov 17, 2024
f6047c0
added default values for constructor
Nov 21, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -145,6 +145,7 @@ sast:
value: "2555"
- type: "find_sec_bugs_type"
value: "SPRING_ENDPOINT"
- id: "db914ce5737b49650ae650fc3b0fe38a531eadd8ea780f48a013419c4adec7f0"
```

And now you can modify execution commands as follows:
Expand Down
217 changes: 100 additions & 117 deletions poetry.lock
View file
Open in desktop

Large diffs are not rendered by default.

1 change: 1 addition & 0 deletions pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@ python = "^3.10"
junit-xml = "^1.9"
PyYAML = "^6.0"
pytest = "^7.2.0"
setuptools = "^75.5.0"

[tool.poetry.dev-dependencies]

Expand Down
36 changes: 30 additions & 6 deletions secscanner2junit/config.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,15 +2,22 @@


class Suppression:
def __init__(self, type, value):

def __init__(self,
id: str | None = None,
type: str | None = None,
value: str | None = None):
self.id = id
self.type = type
self.value = value

def __repr__(self):
return f"Suppression(type={self.type}, value={self.value})"
return f"Suppression(id={self.id}, type={self.type}, value={self.value})"

def __eq__(self, other):
if isinstance(other, Suppression):
if self.id is not None:
return self.id == other.id
return self.type == other.type and self.value == other.value

return False
Expand All @@ -36,9 +43,17 @@ def __is_identifier_suppressed(self, identifier):
return False

def __is_vulnerability_suppressed(self, vulnerability):
for identifier in vulnerability['identifiers']:
if self.__is_identifier_suppressed(identifier):
return True
for suppression in self.suppressions:
if suppression is None:
return False

if suppression.id is not None:
return suppression.id == vulnerability['id']

for identifier in vulnerability['identifiers']:
if suppression.type == identifier['type'] and suppression.value == identifier['value']:
return True

return False

def suppress(self, vulnerabilities):
Expand Down Expand Up @@ -91,6 +106,15 @@ def __get_suppressions(sast_yml_dict):

def __get_suppression(suppression_yml_dict):
try:
return Suppression(suppression_yml_dict['type'], suppression_yml_dict['value'])
return Suppression(__get_suppression_field(suppression_yml_dict, 'id'),
__get_suppression_field(suppression_yml_dict, 'type'),
__get_suppression_field(suppression_yml_dict, 'value'))
except KeyError:
return None


def __get_suppression_field(suppression_yml_dict, key):
try:
return suppression_yml_dict[key]
except KeyError:
return None
36 changes: 18 additions & 18 deletions tests/resources/test_sast/test_basic/gl-sast-report.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,17 +7,17 @@
"name": "Spring CSRF unrestricted RequestMapping",
"message": "Spring CSRF unrestricted RequestMapping",
"description": "Unrestricted Spring's RequestMapping makes the method vulnerable to CSRF attacks",
"cve": "86d80cd1d198812fc1ba6860a9e965e1:SPRING_CSRF_UNRESTRICTED_REQUEST_MAPPING:src/main/java/pl/com/softnet/example/springbootsoftnetexample/PingController.java:23",
"cve": "86d80cd1d198812fc1ba6860a9e965e1:SPRING_CSRF_UNRESTRICTED_REQUEST_MAPPING:src/main/java/pl/com/abc/example/springbootabcexample/PingController.java:23",
"severity": "Medium",
"confidence": "High",
"scanner": {
"id": "find_sec_bugs",
"name": "Find Security Bugs"
},
"location": {
"file": "src/main/java/pl/com/softnet/example/springbootsoftnetexample/PingController.java",
"file": "src/main/java/pl/com/abc/example/springbootabcexample/PingController.java",
"start_line": 23,
"class": "pl.com.softnet.example.springbootsoftnetexample.PingController",
"class": "pl.com.abc.example.springbootabcexample.PingController",
"method": "ping"
},
"identifiers": [
Expand All @@ -40,18 +40,18 @@
"category": "sast",
"name": "Found Spring endpoint",
"message": "Found Spring endpoint",
"description": "pl.com.softnet.example.springbootsoftnetexample.PingController is a Spring endpoint (Controller)",
"cve": "21254b1dfdebd6b8bbd05e4ed8a960c3:SPRING_ENDPOINT:src/main/java/pl/com/softnet/example/springbootsoftnetexample/PingController.java:23",
"description": "pl.com.abc.example.springbootabcexample.PingController is a Spring endpoint (Controller)",
"cve": "21254b1dfdebd6b8bbd05e4ed8a960c3:SPRING_ENDPOINT:src/main/java/pl/com/abc/example/springbootabcexample/PingController.java:23",
"severity": "Low",
"confidence": "Low",
"scanner": {
"id": "find_sec_bugs",
"name": "Find Security Bugs"
},
"location": {
"file": "src/main/java/pl/com/softnet/example/springbootsoftnetexample/PingController.java",
"file": "src/main/java/pl/com/abc/example/springbootabcexample/PingController.java",
"start_line": 23,
"class": "pl.com.softnet.example.springbootsoftnetexample.PingController",
"class": "pl.com.abc.example.springbootabcexample.PingController",
"method": "ping"
},
"identifiers": [
Expand All @@ -68,18 +68,18 @@
"category": "sast",
"name": "Found Spring endpoint",
"message": "Found Spring endpoint",
"description": "pl.com.softnet.example.springbootsoftnetexample.FakeErrorController is a Spring endpoint (Controller)",
"cve": "62a35767e47f86da1958c888ab0ddb98:SPRING_ENDPOINT:src/main/java/pl/com/softnet/example/springbootsoftnetexample/FakeErrorController.java:16",
"description": "pl.com.abc.example.springbootabcexample.FakeErrorController is a Spring endpoint (Controller)",
"cve": "62a35767e47f86da1958c888ab0ddb98:SPRING_ENDPOINT:src/main/java/pl/com/abc/example/springbootabcexample/FakeErrorController.java:16",
"severity": "Low",
"confidence": "Low",
"scanner": {
"id": "find_sec_bugs",
"name": "Find Security Bugs"
},
"location": {
"file": "src/main/java/pl/com/softnet/example/springbootsoftnetexample/FakeErrorController.java",
"file": "src/main/java/pl/com/abc/example/springbootabcexample/FakeErrorController.java",
"start_line": 16,
"class": "pl.com.softnet.example.springbootsoftnetexample.FakeErrorController",
"class": "pl.com.abc.example.springbootabcexample.FakeErrorController",
"method": "getDomainError"
},
"identifiers": [
Expand All @@ -97,17 +97,17 @@
"name": "HTTP headers untrusted",
"message": "HTTP headers untrusted",
"description": "Request header can easily be altered by the client",
"cve": "6b0c63f9593aecd2ad80afdc4a85656d:SERVLET_HEADER:src/main/java/pl/com/softnet/example/springbootsoftnetexample/PingController.java:50",
"cve": "6b0c63f9593aecd2ad80afdc4a85656d:SERVLET_HEADER:src/main/java/pl/com/abc/example/springbootabcexample/PingController.java:50",
"severity": "Low",
"confidence": "Low",
"scanner": {
"id": "find_sec_bugs",
"name": "Find Security Bugs"
},
"location": {
"file": "src/main/java/pl/com/softnet/example/springbootsoftnetexample/PingController.java",
"file": "src/main/java/pl/com/abc/example/springbootabcexample/PingController.java",
"start_line": 50,
"class": "pl.com.softnet.example.springbootsoftnetexample.PingController$IpAddressUtils",
"class": "pl.com.abc.example.springbootabcexample.PingController$IpAddressUtils",
"method": "getIpAddressFromRequest"
},
"identifiers": [
Expand All @@ -124,18 +124,18 @@
"category": "sast",
"name": "Found Spring endpoint",
"message": "Found Spring endpoint",
"description": "pl.com.softnet.example.springbootsoftnetexample.FakeErrorController is a Spring endpoint (Controller)",
"cve": "8e968b3dea7c8b68b43c07ab9b37c120:SPRING_ENDPOINT:src/main/java/pl/com/softnet/example/springbootsoftnetexample/FakeErrorController.java:11",
"description": "pl.com.abc.example.springbootabcexample.FakeErrorController is a Spring endpoint (Controller)",
"cve": "8e968b3dea7c8b68b43c07ab9b37c120:SPRING_ENDPOINT:src/main/java/pl/com/abc/example/springbootabcexample/FakeErrorController.java:11",
"severity": "Low",
"confidence": "Low",
"scanner": {
"id": "find_sec_bugs",
"name": "Find Security Bugs"
},
"location": {
"file": "src/main/java/pl/com/softnet/example/springbootsoftnetexample/FakeErrorController.java",
"file": "src/main/java/pl/com/abc/example/springbootabcexample/FakeErrorController.java",
"start_line": 11,
"class": "pl.com.softnet.example.springbootsoftnetexample.FakeErrorController",
"class": "pl.com.abc.example.springbootabcexample.FakeErrorController",
"method": "getSomeFakeError"
},
"identifiers": [
Expand Down
28 changes: 14 additions & 14 deletions tests/resources/test_sast/test_sast_suppression/gl-sast-report-many-with-same-name.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,17 +7,17 @@
"name": "Spring CSRF unrestricted RequestMapping",
"message": "Spring CSRF unrestricted RequestMapping",
"description": "Unrestricted Spring's RequestMapping makes the method vulnerable to CSRF attacks",
"cve": "86d80cd1d198812fc1ba6860a9e965e1:SPRING_CSRF_UNRESTRICTED_REQUEST_MAPPING:src/main/java/pl/com/softnet/example/springbootsoftnetexample/PingController.java:23",
"cve": "86d80cd1d198812fc1ba6860a9e965e1:SPRING_CSRF_UNRESTRICTED_REQUEST_MAPPING:src/main/java/pl/com/abc/example/springbootabcexample/PingController.java:23",
"severity": "Medium",
"confidence": "High",
"scanner": {
"id": "find_sec_bugs",
"name": "Find Security Bugs"
},
"location": {
"file": "src/main/java/pl/com/softnet/example/springbootsoftnetexample/PingController.java",
"file": "src/main/java/pl/com/abc/example/springbootabcexample/PingController.java",
"start_line": 23,
"class": "pl.com.softnet.example.springbootsoftnetexample.PingController",
"class": "pl.com.abc.example.springbootabcexample.PingController",
"method": "ping"
},
"identifiers": [
Expand All @@ -40,18 +40,18 @@
"category": "sast",
"name": "Found Spring endpoint",
"message": "Found Spring endpoint",
"description": "pl.com.softnet.example.springbootsoftnetexample.PingController is a Spring endpoint (Controller)",
"cve": "21254b1dfdebd6b8bbd05e4ed8a960c3:SPRING_ENDPOINT:src/main/java/pl/com/softnet/example/springbootsoftnetexample/PingController.java:23",
"description": "pl.com.abc.example.springbootabcexample.PingController is a Spring endpoint (Controller)",
"cve": "21254b1dfdebd6b8bbd05e4ed8a960c3:SPRING_ENDPOINT:src/main/java/pl/com/abc/example/springbootabcexample/PingController.java:23",
"severity": "Low",
"confidence": "Low",
"scanner": {
"id": "find_sec_bugs",
"name": "Find Security Bugs"
},
"location": {
"file": "src/main/java/pl/com/softnet/example/springbootsoftnetexample/PingController.java",
"file": "src/main/java/pl/com/abc/example/springbootabcexample/PingController.java",
"start_line": 23,
"class": "pl.com.softnet.example.springbootsoftnetexample.PingController",
"class": "pl.com.abc.example.springbootabcexample.PingController",
"method": "ping"
},
"identifiers": [
Expand All @@ -68,18 +68,18 @@
"category": "sast",
"name": "Found Spring endpoint",
"message": "Found Spring endpoint",
"description": "pl.com.softnet.example.springbootsoftnetexample.FakeErrorController is a Spring endpoint (Controller)",
"cve": "62a35767e47f86da1958c888ab0ddb98:SPRING_ENDPOINT:src/main/java/pl/com/softnet/example/springbootsoftnetexample/FakeErrorController.java:16",
"description": "pl.com.abc.example.springbootabcexample.FakeErrorController is a Spring endpoint (Controller)",
"cve": "62a35767e47f86da1958c888ab0ddb98:SPRING_ENDPOINT:src/main/java/pl/com/abc/example/springbootabcexample/FakeErrorController.java:16",
"severity": "Low",
"confidence": "Low",
"scanner": {
"id": "find_sec_bugs",
"name": "Find Security Bugs"
},
"location": {
"file": "src/main/java/pl/com/softnet/example/springbootsoftnetexample/FakeErrorController.java",
"file": "src/main/java/pl/com/abc/example/springbootabcexample/FakeErrorController.java",
"start_line": 16,
"class": "pl.com.softnet.example.springbootsoftnetexample.FakeErrorController",
"class": "pl.com.abc.example.springbootabcexample.FakeErrorController",
"method": "getDomainError"
},
"identifiers": [
Expand All @@ -97,17 +97,17 @@
"name": "HTTP headers untrusted",
"message": "HTTP headers untrusted",
"description": "Request header can easily be altered by the client",
"cve": "6b0c63f9593aecd2ad80afdc4a85656d:SERVLET_HEADER:src/main/java/pl/com/softnet/example/springbootsoftnetexample/PingController.java:50",
"cve": "6b0c63f9593aecd2ad80afdc4a85656d:SERVLET_HEADER:src/main/java/pl/com/abc/example/springbootabcexample/PingController.java:50",
"severity": "Low",
"confidence": "Low",
"scanner": {
"id": "find_sec_bugs",
"name": "Find Security Bugs"
},
"location": {
"file": "src/main/java/pl/com/softnet/example/springbootsoftnetexample/PingController.java",
"file": "src/main/java/pl/com/abc/example/springbootabcexample/PingController.java",
"start_line": 50,
"class": "pl.com.softnet.example.springbootsoftnetexample.PingController$IpAddressUtils",
"class": "pl.com.abc.example.springbootabcexample.PingController$IpAddressUtils",
"method": "getIpAddressFromRequest"
},
"identifiers": [
Expand Down
Loading
Loading